Skip to main content

Cisco Releases Security Advisories for Critical Vulnerabilities in Identity Services Engine

An authenticated attacker could exploit the vulnerabilities to achieve remote code execution

Threat ID:
CC-4772
Threat Severity:
Medium
Published:
16 April 2026 2:03 PM
Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

An authenticated attacker could exploit the vulnerabilities to achieve remote code execution

Threat details

Introduction

Cisco has released two security advisories to address a four vulnerabilities in Cisco Identity Services Engine (ISE). Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.

  • CVE-2026-20147 - 'Improper Neutralization of Special Elements used in a Command' vulnerability - CVSS v3.1 Base Score: 9.9 
  • CVE-2026-20148 - 'Improper Limitation of a Pathname to a Restricted Directory' vulnerability - CVSS v3.1 Base Score: 4.9
  • CVE-2026-20186 - 'Improper Neutralization of Special Elements used in a Command' vulnerability - CVSS v3.1 Base Score: 9.9
  • CVE-2026-20180 - 'Improper Limitation of a Pathname to a Restricted Directory' vulnerability - CVSS v3.1 Base Score: 9.9

Remediation advice

Affected organisations are strongly encouraged to review Cisco Security Advisories cisco‑sa‑ise‑rce‑traversal‑8bYndVrZ and cisco-sa-ise-rce-4fverepv, and apply the relevant software updates as soon as possible

CVE Vulnerabilities

Status Published

CVE-2026-20147

A vulnerability in Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device. To exploit this vulnerability, the attacker must have valid administrative credentials. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to obtain user-level access to the underlying operating system and then elevate privileges to root. In single-node ISE deployments, successful exploitation of this vulnerability could cause the affected ISE node to become unavailable, resulting in a denial of service (DoS) condition. In that condition, endpoints that have not already authenticated would be unable to access the network until the node is restored.
Status Published

CVE-2026-20148

A vulnerability in Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to perform path traversal attacks on the underlying operating system and read arbitrary files. To exploit this vulnerability, the attacker must have valid administrative credentials. This vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected system. A successful exploit could allow the attacker to access sensitive files on the affected system.
Status Published

CVE-2026-20180

A vulnerability in Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device. To exploit this vulnerability, the attacker must have at least Read Only Admin credentials. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to obtain user-level access to the underlying operating system and then elevate privileges to root. In single-node ISE deployments, successful exploitation of these vulnerabilities could cause the affected ISE node to become unavailable, resulting in a denial of service (DoS) condition. In that condition, endpoints that have not already authenticated would be unable to access the network until the node is restored.
Status Published

CVE-2026-20186

A vulnerability in Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device. To exploit this vulnerability, the attacker must have at least Read Only Admin credentials. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to obtain user-level access to the underlying operating system and then elevate privileges to root. In single-node ISE deployments, successful exploitation of these vulnerabilities could cause the affected ISE node to become unavailable, resulting in a denial of service (DoS) condition. In that condition, endpoints that have not already authenticated would be unable to access the network until the node is restored.

Last edited: 16 April 2026 2:03 pm